SASE Definition
In today’s digital landscape, organizations constantly seek ways to enhance network security, simplify infrastructure, and optimize performance. One emerging concept that has gained significant attention is Secure Access Service Edge (SASE). In this blog post, we will delve into the definition of SASE, its key components, and how it can revolutionize how businesses approach network and security architecture.
Secure Access Service Edge (SASE) is a transformative network architecture model that combines network and security services into a unified cloud-native solution. It offers a holistic approach to networking, allowing organizations to connect securely to cloud resources, applications, and data centers, regardless of their location or the devices being used.
Highlights: SASE Definition
- Multiple network and security functions
SASE definition, or Secure Access Service Edge, is a modern networking solution that combines multiple security functions into a single platform. This solution is designed to provide secure access to cloud-based applications, data, and services. SASE architecture is built on top of a cloud-native platform that integrates software-defined wide-area networking (SD-WAN) and security functions like secure web gateway (SWG), cloud access security broker (CASB), firewall as a service (FWaaS), zero-trust network access (ZTNA).
- Traditional complex methods
SASE meaning is becoming increasingly popular among organizations because it provides a more flexible and cost-effective approach to networking and security. The traditional approach to networking and security involves deploying multiple devices or appliances, each with its own set of functions. This approach can be complex, time-consuming, and expensive to manage. On the other hand, SASE simplifies this process by integrating all the necessary functions into a single platform.
- SASE: A scalable approach
SASE also provides a more scalable and adaptable solution for organizations adopting cloud-based applications and services. With SASE, organizations can connect to cloud-based platforms like AWS, Azure, or Google Cloud, ensuring secure data and application access. Additionally, SASE provides better visibility and control over network traffic, allowing organizations to monitor and manage their network more effectively.
Related: For additional pre-information, you may find the following helpful for pre-information:
SASE Definition |
|
- A key point: Video on SASE deployment.
In the following video, we are going to address SASE deployment. In particular, we will look at the Cisco version of SASE with Cisco Umbrella. We will look at a sample SASE design consisting of several PoPs geographically depressed, along with what each of these PoPs may look like.
Remember that SASE is not a one-box solution; everyone will have different networking and security requirements, and I will offer guidance on starting a SASE project. I think the best place to start a SASE project is with SD-WAN. SD-WAN is mainstream now and has some great SD-WAN security features.
Vendor Example: Cisco Umbrella
The Power of Secure Access Service Edge (SASE)
One of the key concepts associated with Cisco Umbrella is Secure Access Service Edge (SASE). SASE combines network security and wide-area networking (WAN) capabilities into a single cloud-native service. By converging multiple security functions such as secure web gateways, firewall-as-a-service, and data loss prevention, SASE provides a unified and simplified approach to network security. Cisco Umbrella is crucial in the SASE framework by seamlessly integrating cloud security services with the network.
Key Features and Benefits
Cisco Umbrella offers a range of powerful features that enhance network security. These include threat intelligence, advanced malware protection, secure internet gateway, and DNS-layer security. By leveraging the power of machine learning and data analytics, Umbrella continuously analyzes global internet activity to identify and block threats in real time. Moreover, its intuitive dashboard gives administrators granular visibility and control over network traffic, enabling them to make informed decisions and respond swiftly to potential threats.
SASE: A Cloud-Centric Approach
Firstly, the SASE meaning is down to the environment that we are in. In a cloud-centric world, users and devices require access to services everywhere. The focal point has changed. Now, the identity of the user and device, as opposed to the traditional model, focuses solely on the data center with many network security components. These environmental changes have created a new landscape we must protect and connect.
Many common problems challenge the new landscape. Due to deployed appliances for different technology stacks, enterprises are loaded with complexity and overhead. The legacy network and security designs increase latency. In addition, the world is encrypted when considering Zero Trust SASE. This needs to be inspected without degrading application performance.
These are reasons to leverage a cloud-delivered secure access service edge (SASE). SASE means a tailored network fabric optimized where it makes the most sense for the user, device, and application – at geographically dispersed PoPs enabling technologies that secure your environment with technologies such as single packet authorization.
SASE Meaning | Main SASE Definition Components SASE - Secure Access Service Edge
|
Components of SASE:
1. Network as a Service (NaaS): SASE integrates network services such as SD-WAN (Software-Defined Wide Area Network) and cloud connectivity to provide organizations with a flexible and scalable network infrastructure. With NaaS, businesses can optimize network performance, reduce latency, and ensure reliable connectivity across different environments.
2. Security as a Service (SECaaS): SASE incorporates various security services, including secure web gateways, firewall-as-a-service, data loss prevention, and zero-trust network access. By embedding security into the network infrastructure, SASE enables organizations to enforce consistent security policies, protect against threats, and simplify the management of security measures.
3. Zero-Trust Architecture: SASE adopts a zero-trust approach, which assumes that no user or device should be trusted by default, even within the network perimeter. By implementing continuous authentication, access controls, and micro-segmentation, SASE ensures that every user and device is verified before accessing network resources, reducing the risk of unauthorized access and data breaches.
4. Cloud-Native Architecture: SASE leverages cloud-native technologies to provide a scalable, agile, and elastic network and security infrastructure. By transitioning from legacy hardware appliances to software-defined solutions, SASE enables organizations to respond more to changing business requirements, reduce costs, and improve overall efficiency.
Benefits of SASE:
1. Enhanced Security: By integrating security into the network infrastructure, SASE provides a unified and consistent security approach across all network edges, reducing potential vulnerabilities and simplifying security management.
2. Increased Agility: SASE enables organizations to quickly adapt to changing business requirements by providing on-demand network and security services that can be quickly provisioned and scaled as needed.
3. Improved User Experience: With SASE, users can securely access applications and resources from anywhere, on any device, without compromising performance or experiencing network congestion.
4. Cost Savings: By consolidating network and security services into a single cloud-native solution, organizations can reduce hardware and maintenance costs, streamline their infrastructure, and optimize resource utilization.
Secure Access Service Edge SASE Advantages Cloud Delivered: Network and Security
| Secure Access Service Edge SASE Technologies Cloud Delivered: Network and Security
|
Lab Guide on Phishing Attacks
The Social-Engineer Toolkit (SET)
In this lab, we have a fake Google login page that we can use to capture the username and password. This process is known as phishing, and here, I will use the Social-Engineer Toolkit (SET), specifically designed to perform advanced attacks against the human element.
Note:
SET was designed to be released with the http://www.social-engineer.org launch and has quickly become a standard tool in a penetration tester arsenal. The attacks built into the toolkit are intended to be focused attacks against a person or organization used during a penetration test. There are a couple of steps to perform, and I’m using Kali Linux.
- Once the Social Engineering Toolkit loads, select 1) Social-Engineering Attacks from the menu.
- Select 2) Website Attack Vectors from the following menu.
- Select 3) Credential Harvester Attack Method from the following menu.
- Select 1) Web Templates method from next to the menu.
- The following prompt will ask for your IP address for the POST request. The default IP [xx.xx.xx.xx] is correct, so hit Enter here.
- Next, select the 2—Google template.
The credential harvester attack is a phishing attack where attackers create deceptive websites or emails to trick unsuspecting victims into providing their login credentials. These malicious actors often mimic legitimate websites or services, luring users into entering their usernames, passwords, or other sensitive information.
Techniques Employed by Credential Harvesters
Credential harvesters employ various techniques to make their attacks more convincing. They may use URL manipulation, where the website’s URL appears genuine, but in reality, it redirects to a fraudulent page designed to capture user credentials. Another method involves creating spoofed emails with links that lead to imitation login pages.
Consequences of Falling Victim to Credential Harvesters
The consequences of falling victim to credential harvesters can be severe. Once attackers obtain login credentials, they can gain unauthorized access to personal accounts, financial information, or corporate networks. This can result in identity theft, financial loss, reputational damage, and compromised privacy.
Analysis:
-
- This is an effortless way that attackers use malicious links inside emails, texts, or social media messages. If those links are clicked, it directs the user to a fake login page to capture their credentials!
- Fortunately, there are several preventive measures individuals and organizations can take to safeguard against credential harvester attacks. Implementing robust and unique passwords, enabling two-factor authentication, and regularly updating software and security patches are effective ways to enhance security.
- Additionally, being cautious of unsolicited emails, scrutinizing URLs before entering credentials, and educating oneself about phishing techniques can significantly reduce the risk of falling victim to such attacks.
In conclusion, the credential harvester attack method poses a significant threat to individuals and organizations. By understanding the techniques employed by attackers, being aware of the consequences, and implementing preventive measures, we can fortify our defenses against these malicious activities. Remember, staying vigilant and practicing good cybersecurity hygiene is the key to staying one step ahead of cybercriminals.
Back to Basics: SASE Definition
Generally, SASE services include SD-WAN, Zero-Trust Network Access (ZTNA), Cloud Access Security Broker (CASB), NGFW, Secure Web Gateway (SWG), unified management, and orchestration. Just what constitutes a real SASE solution varies significantly by source.
Several organizations, such as the Metro Ethernet Forum (MEF), are trying to establish neutral industry standards for SASE. These standards will pave the way for a universal understanding, the ability to integrate multiple manufacturers into a solution, and a method for teaching SASE.
SASE Meaning
The rise of SASE and digital transformation
There has been a loss of confidence in the network. As a result, organizations uncover weaknesses in their networks when they roll out digital initiatives. This seems to be true for MPLS backbones and in some SD-WAN designs, where there is a lag in security, cloud connectivity, mobility, and site connectivity.
Confidence in SD-WAN and MPLS has significantly decreased when confronted with the digital structure of network transformation. Intrinsically, SD-WAN is not an all-in-one-encompassing solution, whereas MPLS is rigid and fixed.
It is common to find that they were more confident in their networks before adopting digital transformation than post-digital transformations. Therefore, it is difficult to predict the impact of digital change on networks. Enterprises must ensure they have the proper infrastructure performance and security levels. Digital transformation is not just about replacing MPLS. Networking professionals must broaden their focus to encompass security, cloud, and mobility.
WAN Transformation: SASE Meaning
SASE Meaning
All these problems can be avoided by switching to SASE, a new enterprise networking technology category introduced by Gartner in 2019. SASE meaning is the convergence of security, cloud connectivity, mobility, and site connectivity, enabling the architecture to correlate disparate data points.
It is an all-in-one encompassing solution that provides a ready-made solution for the WAN transformation journey. Gartner expects at least 40% of enterprises to have explicit strategies to adopt SASE by 2024.
Today, customers are looking for a WAN transformation solution that connects and secures all edges – sites, cloud resources, mobile users, and anything else that might emerge tomorrow. MPLS is not the right approach, and some SD-WAN deployments are causing question marks. So, a SASE definition, on the other hand, significantly assists post-digital transformation.
So, let us shine the torch on some of the digital transformation challenges likely to surface. These challenges include complexity with management and operations, site connectivity, performance between locations, inefficient security, and cloud agility.
SASE Definition: Secure Access Service Edge (SASE)
The SASE definition combines network security functions (such as SWG, CASB, FWaaS, and Zero Trust Network Access (ZTNA) with SD-WAN to support organizations’ dynamic, secure access needs. These capabilities are delivered by XaaS primarily and are based on the entity’s identity, real-time context, and security/compliance policies.
SASE changes the focal point to the identity of the user and device. With traditional network design, this was the on-premises data center. The conventional enterprise network and network security architectures place the internal data center as the focal point for access.
These designs are proving ineffective and cumbersome with the rise of cloud and mobile. Traffic patterns have changed considerably, and so has the application logic.
- A key point: “Software-defined” secure access
SASE consolidates networking and security-as-a-service capabilities into a cloud-delivered secure access service edge. The cloud-delivered service provides you with policy-based “software-defined” secure access. The “software-defined” secure access comprises a worldwide fabric of points of presence (POPs) and peering relationships. With the PoP design, the general architecture is to move inspection engines to the sessions, not reroute the engines’ sessions as traditional techniques do. This design is more aligned with today’s traffic patterns and application logic.
-
-
-
- SASE offers a tailorable network fabric comprising the SASE PoPs geographically dispersed.
-
-
The architecture allows you to accurately specify every network session’s performance, reliability, security, and cost. This is based on identity and context. For practical, secure access, decisions must be centered on the entity’s identity at the source of the connection. And not a traditional construct such as the IP address or mere network location. The requesting entity can be the user, device, branch office, IoT device, edge computing location, and policy based on these parameters.
Lab Guide on Identity-Aware-Proxy
Identity Security with Google Cloud
Next, we will have a look at Identity security and Google Cloud. Here, I have a minimal web application with Google App Engine. Then, an Identity-Aware Proxy (IAP) restricts access based on parameters that I can configure.
Note:
- Identity-aware proxy (IAP) is a Google Cloud service allowing fine-grained access control to applications and resources based on user identity. By integrating with Google Cloud Identity and Access Management (IAM), IAP enables organizations to define and enforce access policies easily.
- IAP provides a robust solution, whether protecting sensitive data or mitigating the risk of unauthorized access.
See below; I have enabled IAP for a simple application. For access, I now need to tell the IAP services who can access the application. I do this by adding Principles.
Once an app is protected with IAP, it can use the identity information that IAP provides in the web request headers it passes through. So, for additional identity information, the application will get the logged-in user’s email address and a persistent unique user ID assigned by the Google Identity Service to that user—notice below the additional lines in the application code that get the IAP-provided identity data. Additionally, the X-Goog-Authenticated-User- the IAP service provides headers.
Note:
If there is a risk of IAP being turned off or bypassed, your app can check to make sure the identity information it receives is valid. This uses a third web request header added by IAP called X-Goog-IAP-JWT-Assertion. The header’s value is a cryptographically signed object containing user identity data. Your application can verify the digital signature and use the data provided in this object to ensure that IAP provided it without alteration.
Digital signature verification requires several extra steps, such as retrieving the latest set of Google public keys. You can decide whether your application needs these additional steps based on the risk that someone can turn off or bypass IAP and the application’s sensitivity.
IAP Key Features and Benefits
a) Secure Access Control: IAP offers granular control over who can access specific resources, ensuring that only authorized individuals can gain entry. By leveraging context-aware access policies, organizations can define rules based on user attributes, device security status, and more.
b) Multi-Factor Authentication (MFA): IAP supports using MFA, adding an extra layer of security to the authentication process. The risk of unauthorized access is further reduced by requiring users to provide additional verification factors such as SMS codes or security keys.
c) Centralized Logging and Auditing: IAP provides detailed logs and audit trails, allowing organizations to monitor and track access attempts. This enhances visibility and enables swift action against potential security threats.
Implementing Identity-Aware Proxy
Implementing IAP within your Google Cloud environment is a straightforward process. By following these steps, you can ensure a seamless integration:
a) Enabling IAP: Start by enabling IAP for the desired project in the Google Cloud Console. This will activate the necessary APIs and services.
b) Configuring Access Policies: Define access policies based on user identity, resource paths, and other criteria using the Cloud Console or the IAP API.
c) Fine-tuning authentication Methods: Customize the authentication methods according to your organization’s security requirements. This includes enabling MFA and deciding whether to allow or deny unauthenticated users.
Conclusion: Identity-Aware Proxy (IAP) is a robust security solution offered by Google Cloud. With its granular access control, multi-factor authentication, and centralized logging capabilities, IAP provides organizations with the means to ensure secure access to their cloud resources. By implementing IAP, businesses can enhance their security posture and protect against potential threats.
Security and Identity
With a SASE platform, when we create an object, such as a policy in the networking domain, it is then available in other domains, such as security. So, any policies assigned to users are tied to that user regardless of network location. This removes the complexity of managing network and security policies across multiple locations, users, and devices. Again, all of this can be done from one platform.
Also, when examining security solutions, many buy individual appliances that focus on one job. To troubleshoot, you need to gather information, such as the logs from each device. A SIEM is valuable but can only be used in some organizations as a resource-heavy. For those who don’t have ample resources, the manual process is backbreaking, and there will be false positives.
SASE Definition with Challenge 1: Managing the Network
Looking across the entire networking and security industry, everyone sells individual point solutions that are not a holistic joined-up offering. Thinking only about MPLS replacement leads to incremental, point solution acquisitions when confronted by digital initiatives, making their networks more complex and costly.
Principally, distributed appliances for network and security at every location require additional tasks such as installation, ongoing management, regular updates, and refreshes. This results in far too many security and network configuration points. We see this all the time with NOC and SOC integration efforts.
Numerous integration points
The point-solution approach addresses one issue and requires a considerable amount of integration. Therefore, you must constantly add solutions to the stack, likely resulting in management overhead and increased complexity. Let’s say you are searching for a new car. Would you prefer to build the car with all the different parts or buy the already-built one?
In the same way, if we examine the network and security industry, the way it has been geared up presently is provided in parts. It’s your job to support, manage, and build the stack over time and scale it when needed. Fundamentally, it would help if you were an expert in all the different parts.
However, if you abstract the complexity into one platform, you don’t need to be an expert in everything. SASE is one of the effective ways to abstract management and operational complexity.
SASE Meaning: How SASE solves this
Converging network and security into a single platform does not require multiple integration points. This will eliminate the need to deploy these point solutions and the complexities of managing each. Essentially, with SASE, we can bring each point solution functionalities together and place them under one hood – the SASE cloud. SASE merges all of the networking and security capabilities into a single platform.
This way, you now have a holistic joined-up offering. Customers don’t need to perform upgrades, size, and scale their network. Instead, all this is done for them in the SASE cloud, creating a fully managed and self-healing architecture.
Besides, the convergence is minimal if something goes wrong in one of the SASE Pops. All of this is automatic, and there is no need to set up new tunnels or have administrators step in to perform configurations.
SASE Definition with Challenge 2: Site Connectivity
SD-WAN appliances require other solutions for global connectivity and to connect, secure, and manage mobile users and cloud resources. As a result, many users are turning to Service Providers to handle the integration. The carrier-managed SD-WAN providers integrate a mix of SD-WAN and security devices to form SD-WAN services.
Unfortunately, this often makes the Service Providers inflexible in accommodating new requests. The telco’s lack of agility and high bandwidth costs will remain problematic. Deploying new locations has been the biggest telco-related frustration, especially when connecting offices outside of the telco’s operating region to the company’s MPLS network. For this, they need to integrate with other telcos.
- A key point: Video on SD-WAN
In the following video, we will address the basics of SD-WAN and the challenges of the existing WAN. We will also go through popular features of SD-WAN and integration points with, for example, SASE.
SASE Meaning: How SASE solves this
SASE handles all of the complexities of management. As a result, the administrative overhead for managing and operating a global network that supports site-to-site connectivity and enhanced security, cloud, and mobility is kept to an absolute minimum.
SASE Definition with Challenge 3: Performance Between Locations
The throughput is primarily determined by latency and packet loss, not bandwidth. Therefore, for an optimal experience for global applications, we must explore ways to manage the latency and packet loss end-to-end for last-mile and middle-mile segments. Most SD-WAN vendors don’t control these segments, affecting application performance and service agility.
Consequently, there will be constant tweaking at the remote ends to attain the best performance for your application. With SD-WAN, we can bundle transports and perform link bonding to solve the last mile. However, this does not create any benefits for the middle mile bandwidth.
MPLS will help you overcome the middle-mile problems, but you will likely pay a high price.
SASE Meaning: How SASE solves this
The SASE cloud already has an optimized converged network and security platforms. Therefore, sites need to connect to the nearest SASE PoP. This way, the sites are placed on the global private backbone to take advantage of global route optimization, dynamic path selection, traffic optimization, and end-to-end encryption. The traffic can also be routed over MPLS, directly between sites (not through the SASE PoP), and from IPsec tunnels to third-party devices. The SASE architecture optimizes the last and middle-mile traffic flows.
Optimization techniques
The SASE global backbone has several techniques that improve the network performance, resulting in predictable, consistent latency and packet loss. The SASE cloud has complete control of each PoP and can employ optimizations. It uses proprietary routing algorithms that factor in latency, packet loss, and jitter.
These routing algorithms favor performance over cost and select the optimal route for every network packet. This is compared to Internet routing, where metrics don’t consider what is best for the application or the type.
SASE Definition with Challenge 4: Cloud Agility
Cloud applications are becoming the most critical to organizations, even more severe than those hosted in private data centers. When delivering cloud resources, we must consider more than just providing connectivity. In the past, when we spoke about agility, we were concerned only with the addition of new on-premises sites.
However, now, this conversation needs to encompass the cloud. Primarily, delivering cloud applications is about providing an application experience as responsive as the on-premises applications. However, most SD-WANs have a low response rate for rapidly offering new public cloud infrastructure. MPLS is expensive, rigid, and not built for cloud access.
SASE Meaning: How SASE solves this
SASE natively supports cloud data centers (IaaS) and applications (SaaS) without additional configuration, complexity, or point solutions, enabling built-in cloud connectivity. This further enables the rapid delivery of new public cloud infrastructure.
The SASE PoPs are collocated in the data centers, directly connected to the IXP of the leading IaaS providers, such as Amazon AWS, Microsoft Azure, and Google Cloud Platform. In addition, cloud applications are optimized through SASE’s ability to define the egress points. This helps exit the cloud application traffic at the points closest to the customer’s application instance.
The optimal global routing algorithms can determine the best path from anywhere to the customer’s cloud application instance. This provides optimal performance to the cloud applications regardless of the user’s location.
So, when we talk about performance to the cloud with SASE, the latency to the cloud is comparable to the optimized access provided by the cloud providers, such as AWS Direct Connect or Azure Express Route. So, authentically, SASE provides out-of-the-box cloud performance.
SASE Definition with Challenge 5: Security
The security landscape is constantly evolving. Therefore, network security solutions must develop to form a well-founded landscape. Ransomware and Malware will continue to be the primary security concerns from 2020 onward. This is a challenge for the entire organization to combat the various solutions designed with complex integration points scattered through the network domain.
Security must be a part of any WAN transformation initiative protecting the users and resources regardless of the underlying network managed through a single-pane-of-glass.
However, a bundle of non-integrated security products results in appliance sprawl that hinders your security posture instead of strengthening it. The security solution must defend against emerging threats like malware/ransomware. In addition, it must boost the ability to enforce corporate security policies on mobile users.
Finally, the security solution must also address the increasing cost of buying and managing security appliances and software.
Security and encryption
So, we know there is an increase in complexity due to the disparate tools required to address the different threat vectors. So, for example, we have DLP that can be spread across the SWG, CASB, and DLP but with three other teams managing each. What about the impact of encrypted web traffic on the security infrastructure?
The issue is that most internet traffic is now encrypted, and attackers deliver the payloads, deliver command and control instructions, and exfiltrate data over encrypted protocols. Organizations cannot decrypt all network traffic for performance reasons and avoid looking at sensitive employee information.
Also, there are issues with the scalability of encrypted traffic management solutions. This can, too, cause performance issues.
Lab Guide on Security Backdoors
Using Bash
Bash, short for “Bourne Again SHell,” is a widely used command-line interpreter in Unix-based systems. It provides powerful scripting capabilities, making it a favorite among system administrators and developers. However, this versatility also brings the potential for misuse. This section will explain what a Bash backdoor is and how it functions.
Note:
In the following, I created a backdoor on a corporate machine to maintain persistence within the environment. I performed bash script and system configuration using cron jobs. You will then connect to the created backdoor. Here, we demonstrate how to use tools available on standard operating system installations to bypass an organization’s security controls.
Cron jobs, derived from the word “chronos” meaning time in Greek, are scheduled tasks that run automatically in the background of your server. They follow a specific syntax, using fields to specify when and how often a task should be executed. You can create precise and reliable automated processes by grasping the structure and components of cron jobs.
Analysis: First, the file called file is deleted with the rm command if it already exists. Next, a special pipe, a new communications channel, is called a file. Any information passed to the bash terminal, such as typed commands, is transmitted to a specific IP address and port using the pipe. The | indicates the point the output from one Linux command passes information to the next command. Using this single line, you can create a network connection to a specific machine, giving remote access to a user.
Analysis: First, errors when running the cron task are ignored and not printed on the screen. Then, the new cronjob is printed to the screen; in this example, the backdoor bash shell will run every minute. The output of the echoed command is then written to the cronfile with crontab.
Conclusion:
Backdoor access refers to a hidden method or vulnerability intentionally created within a system or software that allows unauthorized access or control. It is an alternative entry point that bypasses conventional security measures, often undetected.
While backdoor access can be misused for malicious purposes, it is essential to acknowledge that there are legitimate reasons for its existence. Government agencies may utilize backdoor access to monitor criminal activities or ensure national security. Additionally, software developers may implement backdoor access for debugging and maintenance purposes.
Stringent security measures are necessary to counter the threats posed by backdoor access. Regular system audits, vulnerability assessments, and robust encryption protocols can help identify and patch potential vulnerabilities. Fostering a security-conscious culture among users and promoting awareness of potential risks can strengthen overall cybersecurity.
- A key point: Video on Stateful Inspection Firewall
We know we have a set of well-defined protocols that are used to communicate over our networks. Let’s call these communication rules. You are probably familiar with the low-layer transport protocols, such as TCP and UDP, and higher application layer protocols, such as HTTP and FTP.
Generally, we interact directly with the application layer and have networking and security devices working at the lower layers. So when Host A wants to talk to Host B, it will go through a series of communication layers with devices working at each layer. A device that works at one of these layers is a stateful firewall.
MPLS and SD-WAN
MPLS does not protect the resources and users, certainly not those connected to the Internet. On the other hand, SD-WAN service offerings are not all created equal since many do not include firewall/security features for threat protection to protect all edges – mobile devices, sites, and cloud resources. This lack of integrated security complicates SD-WAN deployments. Also, this often leads to Malware getting past the perimeter unnoticed.
The cost involved
Security solutions are expensive, and there is never a fixed price. Some security vendors may charge on the usage models for which you don’t yet have the quantity. This makes the process of planning extremely problematic and complex. As the costs keep increasing, we often find that security professionals would trade off point-security solutions due to the associated costs. This is not an effective risk-management strategy.
The security controls are also limited to mobile VPN solutions. More often than not, they are very coarse, forcing IT to open access to all the network resources. Protecting mobile users requires additional security tools like next-generation firewalls (NGFWs). So again, we have another point solution. In addition, mobile VPN solutions provide no last- or middle-mile optimization.
SASE Meaning: How SASE solves this
SASE converges a complete security stack into the network, allowing SASE to bring granular control to sites and mobile and cloud resources. This is done by enforcing the zero-trust principles for all edges. SASE provides the capability of anti-malware protection for both WAN and Internet traffic. In addition, for malware detection and prevention, SASE can offer signature and machine-based learning protection consisting of several integrated anti-malware engines.
For malware communication, SASE can stop the outbound traffic to C&C servers based on reputation feeds and network behavioral analysis. Mobile user traffic is fully protected by SASE’s advanced security services, including NGFW, secure web gateway (SWG), threat prevention, and managed threat detection and response.
Furthermore, in the case of mobile, SASE mobile users can dynamically connect to the closest SASE PoP regardless of the location. Again, as discussed previously, the SASE cloud’s relevant optimizations are available for mobile users.
Rethink the WAN
The shift to the cloud, edge computing, and mobility offer new opportunities for IT professionals. To support these digital initiatives, the network professionals must rethink their approach to the WAN transformation. WAN transformation is not just about replacing MPLS with SD-WAN. It needs an all-encompassing solution that provides the proper network performance and security level for enhanced site-to-site connectivity, security, mobile, and cloud.
SASE Meaning: SASE wraps up
SASE is a network and security architecture consolidating numerous network and security functions, traditionally delivered as siloed point solutions, into an integrated cloud service. It combines several network and security capabilities along with cloud-native security functions. The functions are produced from the cloud and provided by the SASE vendor.
They are essentially providing a consolidated, platform-based approach to security. We have a cloud-delivered solution consolidating multiple edge network security controls and network services into a unified solution with centralized management and distributed enforcement.
The appliance-based perimeter
Even Though there has been a shift to the cloud, the traditional perimeter network security solution has remained appliance-based. The shift for moving security controls to the cloud is for better protection and performance, plus ease of deployment and maintenance.
The initial performance of the earlier cloud-delivered solutions has been overcome with the introduction of optimized routing and global footprint. However, there is a split in opinion about performance and protection. Many consider protection and performance prime reasons to remain on-premises and keep the network security solutions on-premises.
Key Components of SASE
The key components of SASE include software-defined wide-area networking (SD-WAN), cloud-native secure web gateways (SWG), zero-trust network access (ZTNA), firewall-as-a-service (FWaaS), and data loss prevention (DLP), among others. These components work harmoniously to provide organizations with a holistic and scalable solution for secure network connectivity, regardless of the location or device used by the end-user.
Benefits of SASE
SASE offers numerous benefits for organizations seeking to enhance their network infrastructure and security posture. Firstly, it provides simplified network management by consolidating various functions into a unified platform. Secondly, it offers an improved user experience through optimized connectivity and reduced latency. Additionally, SASE enables organizations to embrace cloud services securely and facilitates seamless scalability to adapt to changing business demands.
Implications for the Future
As businesses embrace digital transformation and remote work becomes more prevalent, the demand for flexible and secure network architectures like SASE is expected to skyrocket. SASE empowers organizations to overcome the limitations of traditional network setups and enables them to thrive in an increasingly dynamic and interconnected world. With its cloud-native approach and emphasis on security, SASE is poised to redefine how networks are designed and managed in the coming years.
Conclusion: In conclusion, Secure Access Service Edge (SASE) represents a groundbreaking approach to network architecture, seamlessly merging networking and security functions into a unified cloud-native platform. With its numerous benefits and potential to reshape the digital landscape, SASE is gaining momentum as the future of network infrastructure. By embracing SASE, organizations can future-proof their networks, enhance security, and unlock new levels of productivity and agility in an ever-evolving digital era.
 | Main Checklist Points To Consider
|
- Fortinet’s new FortiOS 7.4 enhances SASE - April 5, 2023
- Comcast SD-WAN Expansion to SMBs - April 4, 2023
- Cisco CloudLock - April 4, 2023